infisical-secret-scanning
Guide for Infisical Secret Scanning — detecting leaked credentials in source code and developer systems. Covers the 3 cloud data sources (GitHub via a GitHub Radar connection, GitLab, Bitbucket), full scans vs automatic diff scans on push, finding lifecycle and severity, the infisical scan CLI for Git history, working directories, staged changes and CI pipelines, pre-commit hook installation with infisical scan install --pre-commit-hook, noise reduction via infisical-scan:ignore, .infisicalignore, entropy thresholds and custom rules, and AWS honey tokens as decoy credentials that alert on use. Use this skill when someone asks about: Infisical secret scanning, finding leaked secrets in a repo, scanning git history for credentials, pre-commit secret scanning, false positives in scanning, or honey tokens. Not for storing secrets so they stop leaking (infisical-setup) or rotating one that leaked (infisical-secret-rotation). GitHub scanning needs a github-radar App Connection, not a git
- Installs
- 158
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/infisical/ai-skills --skill infisical-secret-scanning- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads infisical-secret-scanning automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Infisical Secret Scanning Guide
You are a setup assistant helping users detect leaked credentials in source code and respond when they find them.
Secret Scanning is a separate Infisical product with its own project type (secret-scanning).
Two halves that solve different problems
Keep these distinct when advising:
| Half | What it does | When it catches a leak |
|---|---|---|
| Cloud data sources | Monitor connected GitHub/GitLab/Bitbucket repos | After the secret is pushed |
CLI (infisical scan) | Scan local directories, Git history, staged changes, CI | Before the push, if wired into a hook or pipeline |
A user who only sets up data sources is detecting leaks after they exist. A user who only uses the CLI has no coverage of what is already in the repo. Recommend both: the CLI as a pre-commit hook to stop new leaks, and a data source to find existing ones and catch anything that bypasses the hook.
Not this skill
| If the user wants... | Use |
|---|---|
| To store secrets so they stop ending up in code | infisical-setup — the actual fix for leaks |
| To rotate a credential that leaked | infisical-secret-rotation |
| To revoke a leaked dynamic credential | infisical-dynamic-secrets |
To create the github-radar App Connection | infisical-app-connections |
| Audit logs of Infisical activity | infisical-access-control |
Worth raising unprompted: scanning is detection, not remediation. When a real finding turns up, the
response is rotate the credential first, then clean the history. A secret in Git history is
compromised even after the commit is removed, because it was already cloned. Point users at
infisical-secret-rotation as part of the incident response, not as a separate conversation.
Data sources
SecretScanningDataSource values, and the App Connection each requires:
| Data source | Value | App Connection |
|---|---|---|
| GitHub | github | github-radar |
| GitLab | gitlab | gitlab |
| Bitbucket | bitbucket | bitbucket |
GitHub scanning needs a github-radar connection, not a github connection. They install
different GitHub Apps with different permissions — Radar needs to read repository contents and
receive push webhooks. Using a github connection here fails. This is the most common setup error
for this product. See infisical-app-connections.
All three trigger automatic scans on push.
How to use this skill
- Wire the CLI into pre-commit so new leaks are stopped at the source
- Connect the data sources for repositories that matter
- Run a full scan to establish a baseline of what already exists
- Triage findings — resolve, mark false positive, or ignore
- Tune to reduce noise so the signal stays credible
- Enable automatic diff scans for ongoing coverage
- Consider honey tokens for detecting misuse rather than exposure
Reference files
| File | When to read |
|---|---|
references/scanning-and-findings.md | Data source setup, scan types and statuses, finding lifecycle and severity, noise reduction |
references/cli-and-honey-tokens.md | infisical scan usage, pre-commit hooks, CI integration, AWS honey tokens |
Guiding principles
github-radar, notgithub. Repeat it; it is the error users hit first.- Rotate before cleaning history. A leaked credential is compromised the moment it is pushed. Rewriting history does not un-leak it.
- False positives destroy the control. A noisy scanner gets ignored, and then a real finding gets ignored too. Invest in ignore rules and entropy tuning early.
- Prefer
.infisicalignoreandinfisical-scan:ignoreover disabling rules. Targeted suppressions keep coverage; disabled rules remove it silently. - Pre-commit hooks are advisory, not enforcement. They can be skipped with
--no-verify. Back them with CI scanning that cannot be bypassed. - Honey tokens detect a different thing. Scanning finds secrets that leaked; honey tokens tell you someone is using stolen credentials. They complement each other.
- Never echo a discovered secret value back to the user in full.
FAQ
What does the infisical-secret-scanning skill do?
Guide for Infisical Secret Scanning — detecting leaked credentials in source code and developer systems. Covers the 3 cloud data sources (GitHub via a GitHub Radar connection, GitLab, Bitbucket), full scans vs automatic diff scans on push, finding lifecycle and severity, the infisical scan CLI for Git history, working directories, staged changes and CI pipelines, pre-commit hook installation with infisical scan install --pre-commit-hook, noise reduction via infisical-scan:ignore, .infisicalignore, entropy thresholds and custom rules, and AWS honey tokens as decoy credentials that alert on use. Use this skill when someone asks about: Infisical secret scanning, finding leaked secrets in a repo, scanning git history for credentials, pre-commit secret scanning, false positives in scanning, or honey tokens. Not for storing secrets so they stop leaking (infisical-setup) or rotating one that leaked (infisical-secret-rotation). GitHub scanning needs a github-radar App Connection, not a git
How do I install infisical-secret-scanning?
Run npx skills add https://github.com/infisical/ai-skills --skill infisical-secret-scanning in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/infisical-secret-scanning/ (personal) or .claude/skills/infisical-secret-scanning/ (project).
Which AI agents can use infisical-secret-scanning?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is infisical-secret-scanning safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains infisical-secret-scanning?
It is published by infisical in infisical/ai-skills. It has 158 recorded installs.
More from infisical/ai-skills
infisical-api
infisical/ai-skills
Interact with the Infisical REST API to manage secrets, projects, environments, machine identities, and more. Supports secret CRUD operations, machine identity authentication, pagination, and rate limiting on cloud deployments. Not for the CLI/SDKs (infisical-setup), KMS crypto endpoints (infisical-kms), certificate endpoints (infisical-pki), or human SSO login (infisical-sso).
infisical-secret-syncs
infisical/ai-skills
Guide for configuring Infisical Secret Syncs to push secrets from Infisical to third-party services. Covers all 48 sync destinations including AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, GitHub, Vercel, HashiCorp Vault, Cloudflare, Snowflake, Databricks, Railway, and more. Use this skill when someone asks about: syncing secrets to AWS/GCP/Azure, pushing secrets to GitHub Actions, Vercel environment variables, secret sync setup, App Connections, mapping behavior, key schemas, initial sync behavior, or 'how do I get my Infisical secrets into [service]'. Not for creating the required App Connection (infisical-app-connections), pulling secrets into an app (infisical-setup), syncing certificates (infisical-pki PKI Syncs), or rotating a credential (infisical-secret-rotation).
infisical-user-setup-guide
infisical/ai-skills
Interactive setup guide for using Infisical as a secret management tool in your projects. Helps users integrate Infisical into local development (CLI), Docker containers (build-time and runtime secret injection), CI/CD pipelines (GitHub Actions, GitLab CI), Kubernetes (Operator + CRDs), and application code (all 9 SDKs: Node.js, Python, Go, Java, .NET, Ruby, PHP, Rust, C++). Also walks through choosing and configuring any of the 13 machine identity auth methods (Universal, Token, Kubernetes, GCP, AliCloud, AWS, Azure, TLS Cert, OCI, OIDC, JWT, LDAP, SPIFFE). Use this skill whenever someone asks about: using Infisical, injecting secrets, infisical run, infisical init, connecting their app to Infisical, Docker secrets, Kubernetes secrets operator, machine identity setup, SDK initialization, CI/CD secret injection, or 'how do I get my secrets into my app'. Not for the Kubernetes Operator CRDs (infisical-kubernetes-operator), rendering secrets to files (infisical-agent), pushing secrets ou
infisical-agent
infisical/ai-skills
Guide for configuring the Infisical Agent — a client daemon that manages token lifecycle and renders secrets via Go templates without modifying application code. Covers the full YAML config format, all 6 agent auth methods (universal-auth, kubernetes, aws-iam, azure, gcp-id-token, gcp-iam), sinks, template functions (listSecrets, listSecretsByProjectSlug, getSecretByName, dynamicSecret), polling, on-change commands, retry strategy, and persistent caching. Use this skill when someone asks about: Infisical Agent, agent config file, agent templates, rendering secrets to files, sidecar secret injection, init container secrets, token renewal, infisical agent command, or 'how do I use the Infisical Agent to inject secrets'. Not for Kubernetes Secrets or ConfigMaps managed by a controller (infisical-kubernetes-operator), nor infisical run (infisical-setup).
infisical-dynamic-secrets
infisical/ai-skills
Guide for configuring Infisical Dynamic Secrets — on-demand, short-lived credentials for databases, cloud IAM, SSH, and Kubernetes. Covers all 30 providers including PostgreSQL, MySQL, MSSQL, Oracle, Redis, AWS ElastiCache, AWS MemoryDB, MongoDB, Elasticsearch, Couchbase, Milvus, AWS IAM, GCP IAM, Azure Entra ID, SSH certificates, Kubernetes service accounts, LDAP, GitHub, Tailscale, IBM API Connect, and TOTP. Use this skill when someone asks about: dynamic secrets, ephemeral database credentials, short-lived tokens, rotating database users, dynamic PostgreSQL/MySQL/Redis credentials, SSH certificates, temporary AWS IAM users, lease renewal, or 'how do I generate temporary credentials with Infisical'. For brand-new short-lived credentials created per request. Not for changing an existing credential on a schedule (infisical-secret-rotation), nor for recorded human/agent access without a credential (infisical-pam). Covers SSH certificates; TLS certificates are infisical-pki.
infisical-self-host
infisical/ai-skills
Deploy and operate Infisical self-hosted instances with Docker, Docker Compose, and Kubernetes. Covers architecture, environment variables, ENCRYPTIONKEY management, PostgreSQL setup, Redis configuration (including the required noeviction policy), production hardening, FIPS 140-3 compliance, scaling, and high availability patterns. For deploying the Infisical platform itself. Not for the Kubernetes Operator, which is a separate Helm chart (infisical-kubernetes-operator), nor for using Infisical once running (infisical-setup).
Popular code quality & workflow skills
grill-me
mattpocock/skills
A relentless interview to sharpen a plan or design.
improve-codebase-architecture
mattpocock/skills
Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.
handoff
mattpocock/skills
Compact the current conversation into a handoff document for another agent to pick up.
domain-modeling
mattpocock/skills
Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.
codebase-design
mattpocock/skills
Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
diagnosing-bugs
mattpocock/skills
Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.